Splunk Search

Using now() in real-time

matthewcanty
Communicator

Hello everyone. I want to track in real-time the time since the last event occurred. When I do this currently the time starts out positive and correct then proceeds to become a progressively larger negative number. I know this is because now() refers to the time at which the search was started. So how do I get NOW now?

My current search is:

host="APP90*-TSDAL" FeedSource="*" 
| stats max(_time) As LatestTime
| eval Gap=round((now()-LatestTime),1)
| fields Gap

Thanks for your help.

Tags (2)
1 Solution

kallu
Communicator

You should use time() instead of now()

View solution in original post

kallu
Communicator

You should use time() instead of now()

View solution in original post

matthewcanty
Communicator

Perfect. Thank you so much.

0 Karma